AUDIT REPORT NOVEMBER

RISK MANAGEMENT AUDIT REPORT NOVEMBER 2009

TABLE OF CONTENTS EXECUTIVE SUMMARY........3 STATEMENT OF ASSURANCE......6 1 INTRODUCTION...7 BACKGROUND......7 AUDIT OBJECTIVES.........9 AUDIT SCOPE AND APPROACH........9 2 FINDINGS..... 11 DESIGN AND GOVERNANCE ARRANGEMENTS....11 OPERATIONAL AND SUPPORT PRACTICES......19 APPENDIX A AUDIT CRITERIA....25 APPENDIX B MAF-BASED INTEGRATED RISK MANAGEMENT FRAMEWORK...27 Cat. No.: SB4-12/2010E-PDF ISBN 978-1-100-15796-2 2

Executive Summary Introduction Since the late 1990s and early 2000s, there has been growing attention to the practice of risk management that, when applied effectively (by balancing formal and informal use), can tangibly strengthen the decision-making process in an ever changing and increasingly complex modern world. For Library and Archives Canada (LAC), managing the way forward for the evolution to digital is a prime example of how today s environment requires significant focus on management of risk. In our current uncertain times, as was noted in the report by the Prime Minister s Advisory Committee on the Public Service (February 2009), there is a need to move toward a risk management approach. The Advisory Committee s recognition of the need for strengthening risk management will have a natural follow-up given that departmental audit committees must now have external members and have been given a clear role to advise deputy heads based on active oversight of core areas specifically including risk management. Furthermore, deputy heads, as accounting officers under revisions to the Financial Administration Act, now have a legal obligation to appear before committees of the Senate and House of Commons to answer questions about maintaining effective systems of internal control, of which risk management is of growing importance. The objective of the audit was to determine the extent to which LAC s risk management practices: comply with policies and guidelines; help to ensure that risks are adequately, proactively and effectively managed in an integrated fashion organization-wide; and are adequately and sufficiently understood to support an internal audit function based on risk. The audit was conducted between November 2008 and February 2009 and the scope of the audit included an examination of risk management practices throughout LAC as well as discussions with other federal government organizations regarding better practices. The audit was based on criteria developed from a LAC initiative to define the key components of risk management in the style of the Management Accountability Framework (MAF). This style was chosen given the strong common understanding of MAF components by managers. LAC s MAF-based framework for risk management was reviewed and validated by senior management. 3

Findings Library and Archives Canada has become a risk aware organization. At this maturity level formal risk management practices are being established in key operational areas, analysis of risk is being integrated with annual and strategic planning and investments have been initiated to develop capacity through training and guidance documents. However, LAC does not have an adequate set of design and governance arrangements including a vision, framework and an implementation strategy outlining the pace, priority and governance of further investment to advance risk management maturity. LAC has also been active in strengthening its operational and support practices for risk management. All operational and departmental groups had some examples of developing formal approaches and procedures for risk management of exposure areas. In addition, there has been some training and progress toward drafting guidance documents. However, these initiatives are not part of a coordinated overall strategy to identify priority exposure areas, develop and maintain appropriate capabilities including attention to stakeholder risk communication needs, and to provide appropriate tools and guidance. Based on its current arrangements and practices, LAC will likely not be able to achieve additional tangible benefits of advanced maturity in risk management. Timely and effective communications about risk based on a developed common understanding, and intelligent (information-based) risk taking are two key future benefits. Advanced risk management maturity is particularly relevant to organizations needing to effectively balance and re-balance growing delivery needs and expectations with ongoing resource restraint. Recommendations The report identifies the following recommendations. Management has agreed with the recommendations and developed an action plan. 1. LAC should develop and implement an overall strategy to strengthen risk management, specifically addressing design and governance arrangements by: a. Establishing a governance body to provide oversight of the development of risk management maturity based on a Risk Management Vision and MAF-based Framework; 4

b. Establishing the position of Chief Risk Officer(CRO) to lead and coordinate the management of risk; c. Allocating additional human resources to support the CRO and the overall strategy to strengthen risk management; d. Arranging for training of senior management to ensure common understanding of risk management concepts, starts from the top; and e. Establishing a Risk Management Policy codifying the department s commitment to risk management and setting out key principles, roles, responsibilities, processes and common terminology. 2. LAC should ensure that the strengthening of risk management operational and support practices are included in the overall strategy, including: a) Establishing a listing of priority risk areas identifying high exposure areas of the department as a means of focusing attention on the most critical areas that need an effective balance of formal and informal practices for risk management; b) Establishing and implementing a knowledge transfer plan incorporating training courses customized for LAC covering orientation to more advanced skills for those who will provide leadership and support roles; c) Ensuring the Risk Management Guide is updated in line with ISO 31000, translated and issued across the department (including electronic posting via a risk management portal); d) Establishing an approach for monitoring and reporting on progress in managing risk integrated with overall performance monitoring and reporting at LAC. 5

Statement of Assurance The audit of risk management was conducted in accordance with the Institute of Internal Auditors Standards for the Professional Practice of Internal Auditing. In our professional judgment, sufficient and appropriate audit procedures were conducted and evidence gathered to support the accuracy of the conclusions reached and contained in this report. In our opinion, based on the audit criteria set out in Appendix A, LAC has clearly begun to strengthen its risk management foundations. However, risk management design and governance arrangements, as well as operational and support practices are not yet sufficient to provide the level of risk management maturity appropriate to the asset stewardship, service delivery, decision making, results and accountability needs of the department. 6

1 INTRODUCTION 1.1 Background Since the late 1990s and early 2000s, there has been growing attention to the practice of risk management that, when applied effectively (by balancing formal and informal use), can tangibly strengthen the decision-making process in an ever changing and increasingly complex modern world. For Library and Archives Canada (LAC), managing well the way forward for the evolution to digital is a prime example of how today s environment requires significant focus on management of risk. Unfortunately, the pace of change and growing complexity necessitating improved risk management practice has come at the same time as the need to improve most other management practices such as integrated planning, performance measurement, and internal audit, to meet escalating expectations regarding accountability, transparency and stewardship. LAC, like most organizations, both public and private, have started initiatives to strengthen its key management practices including risk management. Of the key management practice areas, risk management has been one of the most difficult to improve. In part, because there is a clear awareness that risk is always managed at least informally (often referred to as intuitively), which has proven to work well in the past. With historical reliance on informal risk management, most organizations have not built up their knowledge and capacity on formal practices so the challenge of now blending the formal and informal more effectively is naturally difficult. Managing risk more effectively in the public sector is compounded by cultural norms for prudence and minimal risk on the one hand, and escalating demands for results within restrained resources on the other. While continuing to respect historical norms for prudence, LAC has started to necessarily evolve from minimal risk in selected areas toward managed risk taking (e.g., delegations of authority, partnership arrangements) in order meet result expectations within existing resources. The direction on the requirement to strengthen risk management came with issuance of the Integrated Risk Management Framework (IRM Framework) in 2001, and in 2003 with the Management Accountability Framework (MAF) both developed by the Treasury Board of Canada Secretariat (TBS). These frameworks and a Collections Risk Assessment in 2004 (following a 2003 7

recommendation for such by the Office of the Auditor General) led to a departmental commitment to establish a LAC framework as the foundation for strengthening the management of risk organization-wide. LAC has always responded actively to its significant risk exposure establishing measures such as policies and procedures for proper document management, security arrangements, internal audits, and even capital infrastructure such as the preservation building in Gatineau, Quebec. Since 2004, LAC has been working on developing and implementing an integrated risk management approach which has seen the delivery of training, the drafting of a Risk Management Guide, and the integration of risk management analysis in annual business planning. In addition, LAC documented its strategic risks in its Initial Corporate Risk Profile in 2007. Examples of formal methods for managing operational risk have always existed at LAC. However, with the clearer priority to strengthen risk management in recent years, more examples of formal approaches to managing risk have begun to appear. The risk management plans and risk logs used on major IT projects and the new Risk Management Framework to support LAC Loans/Exhibitions Policy and Procedures are two key examples. For these elements of integrated risk management progress, LAC was given an acceptable rating for risk management in the 2007 (Round V) and 2008 (Round VI) MAF Assessments. This audit of risk management has been initiated in part because the recent MAF assessments were very general in nature (risk management is only one of 21 areas covered) and required minimal practice levels to meet the criteria for an acceptable rating. In addition, risk management is one of three priority areas which Internal Audit must examine and report on according to the TBS Policy on Internal Audit (July 2009) and the Professional Practices Framework of the Institute of Internal Auditors. The other two priority areas Internal Audit must examine and report on are governance and controls. In our current uncertain times, as was noted in the third report of the Prime Minister s Advisory Committee on the Public Service (February 2009), there is a need to move toward a risk management approach. The Advisory Committee s recognition of the need for strengthening risk management will have a natural follow-up given that departmental audit committees must now have external members and have been given a clear role to advise deputy heads based on active oversight of core areas specifically including risk management. Furthermore, deputy heads, as accounting officers under revisions to the Financial Administration Act, now have a legal obligation to appear before committees of the Senate and House of Commons to answer questions about 8

maintaining effective systems of internal control, of which risk management is of growing importance. 1.2 Audit Objectives The objective of the audit was to determine the extent to which LAC s risk management practices: comply with the policies and guidelines of both the Treasury Board of Canada Secretariat and the Office of the Comptroller General; help to ensure that risks are adequately, proactively and effectively managed in an integrated fashion organization-wide; and are adequately and sufficiently understood to support an internal audit function based on risk. 1.3 Audit Scope and Approach The scope of the audit included an examination of governance and risk management practices and controls in place, throughout LAC including the roles for managing and leading the function assigned to planning groups. In addition, the scope included discussions with LAC senior management and managers as well as other federal government organizations regarding better practices and expectations. The audit was conducted in accordance with both the TBS Policy on Internal Audit and the Institute of Internal Auditors International Standards for the Practice of Internal Auditing. During the planning phase of the audit, the scope and objectives were confirmed based on documentation reviews and interviews with key individuals. A detailed audit program was developed that outlined specific criteria and audit tests aimed at assessing the adequacy and effectiveness of risk management practices and controls. During the conduct phase of the audit, the audit program was systematically administered through a wide range of interviews and further documentation reviews. The audit was based on criteria developed from a LAC initiative to define the key components of risk management in the style of the Management Accountability Framework (MAF). This style was chosen given the strong 9

common understanding of MAF components by managers. LAC s MAF-based framework for risk management was reviewed and validated with senior management. The audit was conducted using the ten (10) MAF areas as lines of inquiry arranged in two groups. Criteria for each of these lines of inquiry are set out in Appendix A. Design and Governance Arrangements 1. Governance & Strategic Direction Senior management sets the vision for an integrated approach (horizontal, vertical, functional), provides oversight and direction on risk tolerance, and ensures risk management is integrated into the planning, policy-making, service delivery, and decision-making process. 2. Public Service Values Departmental culture recognizes risk in all activities as well as the need to explicitly manage it 3. Policy & Programs Commitment to risk management and roles are formally set out in a policy, and annual planning for risk management is conducted through a Corporate Risk Profile and Risk Universe. 4. Results & Performance Progress toward risk management maturity is measured and risk reporting and disclosure to senior management, central agencies, Parliament and the public are transparent, balanced and easy to understand. 5. Accountability Risk management roles and accountabilities are integrated into the departmental accountability mechanisms (job descriptions, performance reviews). Operational and Support Practices 6. Risk Management There is an effective balance between informal and formal risk management and risk is mitigated to acceptable level (not absolute minimum as a general rule). Also, is risk is viewed/used for taking advantage of an opportunity. 7. Citizen-focused Service Stakeholder engagement is carried out to ensure their risk perceptions and misperceptions are included in risk analysis. 10

8. Stewardship Risk-related requirements of relevant authorities are incorporated e.g., risk of non-compliance to the Library and Archives of Canada Act, Copyright Act or other authorities (Federal Accountability Act, Financial Administration Act, TBS policies, etc.). 9. People Risk management competency and resource needs are determined and addressed, and risk is communicated in a timely manner. 10. Learning, Innovation & Change Management Risk management is implemented based on ongoing learning and change management principles (including sufficient resources). 2 FINDINGS Criteria: Governance & Strategic Direction Public Service Values Policy & Programs Results & Performance Accountability 2.1 Design and Governance Arrangements Library and Archives Canada has become a risk aware organization. At this risk maturity level formal risk management practices are being established in key operational areas, analysis of risk is being integrated with annual and strategic planning and investments have been initiated to develop capacity through training and guidance documents. However, LAC does not have an adequate set of design and governance arrangements including a vision, framework and an implementation strategy outlining the pace, priority and governance of further investment to advance risk management maturity. LAC will likely not be able to access additional tangible benefits of risk management particularly relevant to organizations needing to effectively balance and re-balance growing delivery requirements and expectations with ongoing resource restraint. Our examination determined that LAC has fully advanced in its management of risk to the risk aware level of maturity. As set out in Figure 1 below, this level of maturity is characterized by the emergence of formal methods to manage more significant risks to complement the effective use of informal methods to manage day-to-day minor and moderate risks. Distinct examples of development of formal processes to match areas of significant exposure include the Risk-based Approach for Disposition of Unmanaged Legacy Records and the Risk Management Framework to be embedded in the revised Risk Management Framework to support LAC Loans/Exhibitions Policy and Procedures. Examples of such key formal processes are just finishing 11

development and effective implementation is yet to come. The recognition of the need and benefit for formal processes is a clear trait of risk awareness. The push to integrate risk analysis into annual business planning activities also demonstrates LAC is at the risk aware level on the risk management maturity model (See Figure 1). Given this process has just started, the efficacy of the information provided by operational branches was mixed (and averaging moderate quality overall). However, the planners in charge of the initiative are reviewing the details provided with each branch in an effort to help branches develop skills in risk analysis and provide information that is overall higher in quality and consistency. Figure 1: Risk Management Maturity Model Functionality Risk Mature Risk Indicators Monitored Well Defined, Common Understanding of Risk Tolerance Risk Attentive Risk Universe Established (Map of Priority Exposure Areas) Intelligent (Information-based) Risk-Taking Risk Aware Formal Methods Emerging for significant risks (Integration with Planning) Risk Management Function Initial Investments Time Intuitive (Informal) Risk Management Countless day to day minor and moderate risks effectively managed Helpful as a factor in decision-making for immediate demands on major issues LAC attained the risk aware level when it allocated corporate resources for a part-time employee (equivalent to 50% FTE) to work, since 2004, on developing an Initial Corporate Risk Profile. The profile identifies the key risks at the strategic level and how they are managed. The employee also invested time in developing a Risk Management Guide. In addition, a financial investment in capacity building was given to selected managers and staff members in 2005 and 2008 on risk management training. All these initiatives illustrate risk awareness; however, there is a clear need to continue capacity building, to further improve the Initial Corporate Risk Profile and to finalize and disseminate the Risk Management Guide. The risk maturity scale illustrated in Figure 1 provides a basic and clear path on which LAC can advance its practice of risk management. It provides an 12

understanding of the next levels Risk Attentive and Risk Mature. Organizations at the risk attentive level are able to be more attentive to risk because they have establish a Risk Universe mapping out the areas of the organization where significant risks are managed but where the methods used to manage risk are not effectively balancing the use of informal and formal approaches generally, there is too much reliance on traditional informal methods creating imprudent high risk exposure for the organization. Mapping out the Risk Universe enables plans to be established and investment directed at appropriately strengthening risk management practices in identified priority areas. Risk attentive is also typified by an overall higher level of risk management capacity (through training and practice) such that managers and staff members can be more deliberate in taking intelligent risks to seize opportunities or terminate low-risk activities based on their degree of comfort with information provided through risk analysis and the freedom to act in such a manner clearly delegated by management. Sample Vision Statement for Risk Management Effectively balancing formal and informal risk management practices aligned with ever evolving risk exposure at all levels of the organization within five (5) years, and creating tangible improvements in strategic planning, stewardship of assets, service delivery, decision making, results and accountability. The highest level of maturity can be simply referred to as Risk Mature. At this level, staff members, managers and senior management can be even more proactive in managing risk because predictive information about risk is provided by risk indicators. In addition, at this level there is a clear expression of risk tolerance that is well understood by all employees and managers. Typically, the organization would have multiple tolerance models reflecting that there are areas in the organization where there must be very low tolerances to risk, and other areas where there can be more tolerance. Our examination revealed that LAC would have difficulty advancing beyond risk aware because it lacks a modern set of arrangements for further investing in risk management. A vision statement, such as the sample shown in the text box, would be the arrangement that articulates where LAC would like to be at some future point this enables the development of strategies, priorities and plans to achieve the vision. LAC risk management arrangements are also lacking an overall framework and an implementation strategy. As part of this audit, a table of 21 framework components was prepared as a detailed set of strategies for becoming risk mature. Figure 2 below (and in Appendix B) illustrates a Risk Management Framework in the style of the Management Accountability Framework (MAF). This style is relevant today because the ten (10) management areas of MAF are well understood by managers and senior management across departments and agencies. If LAC can achieve most or all of the 21 framework components over the next five years, it will become risk mature. 13

Governance & Strategic Directions There is senior management direction on the Vision for IRM (principles, framework, and processes) that is tailored and responsive to the organization s external and internal context, and that supports governmentwide management of risk Risk is managed horizontally (across all Programs), vertically (across all levels of the organization), and functionally ensuring appropriate integration into all key planning, policy-making, delivery, and decision-making processes. There is ongoing seniorlevel oversight of: the management of risks at all levels, effectiveness of risk management arrangements, and adherence toirisk management Policy Guidance is provided on Risk Tolerance and risk mitigation strategies Figure 2: MAF-Based Risk Management Framework Public Service Values Departmental culture recognizes the presence of risk in all activities and the need to explicitly manage risk through mitigation, or avoidance, transfer, or sharing Departmental culture values good risk management as a key component of managerial excellence Policy & Programs Risk Management Policy defining principles, roles & responsibilities, processes, and terms is a key feature the department s risk management arrangements Annual risk management planning (including environmental scanning) is conducted to refine key risks, their management approaches, and to refine the departments risk management arrangements covering tolerance, stakeholders, competencies, etc Risk Management An effective balance is established between informal (intuitive) and formal (systematic, structured) risk management is established and maintained based on context, urgency and significance of risk exposure Risk is not mitigated to absolute minimum as a general rule which can stifle creativity and innovation. Rather, it is reduced to a tolerable or acceptable level. People Risk management competency needs are determined and developed covering risk assessment, risk management, and risk communications Information on risk is communicated timely Stewardship Risk-related requirements of relevant control-related authorities are incorporated: FAA, Fed AA, TBS Policies Indicators for results, risk and accountability managed in an integrated manner Learning, Innovation and Change management Citizen-focused Service External risk Communications and stakeholder engagement is carried out on an ongoing basis to ensure needs, issues and concerns, risk perceptions and mis-perceptions (GoC or stakeholders) are included in risk analysis and decision-making Accountability Risk management roles and responsibilities are integrated into the departmental accountability mechanisms (job descriptions, performance reviews, Terms of Reference, etc) Ongoing risk management learning is developed and implemented Change management principles and practices are applied, including planning for appropriate resources (i.e. people, systems, finances, etc.) Results & Performance Relevant information on risk is gathered and used to make decisions Performance of the risk management arrangements toward Maturity is reported annually to senior management Reporting and Disclosure to Senior Management, Central Agencies, Parliament, and the Public is balanced, transparent and easy to understand. Likely the most important components of the MAF-based Risk Management Framework is the strategy of establishing a Risk Management Policy which defines the principles, roles, responsibilities, processes, and terms. The policy is a key feature in the department s risk management arrangements. The Risk Management Policy affirms strong commitment of senior management to the risk management arrangements including senior management s key role of Senior-level Oversight of: the management of risks at all levels, effectiveness of risk management arrangements, and adherence to Risk Management Policy. In 2008, the International Standards Organization (ISO) published Risk Management Principles and Guidelines on Implementation numbered ISO 31000. Formal issuance of ISO 31000 is expected in 2009. This study has received broad international support including from the Treasury Board of Canada Secretariat (TBS) which has clearly indicated its intention to update its 2001 Integrated Risk Management Framework to be aligned with ISO 31000. The Risk Management Framework component of ISO 31000 is rather straightforward and it reconciles easily to the MAF-based approach as shown in the crosswalk in Figure 3. 14

Figure 3: ISO/MAF Crosswalk Risk Management Framework Components ISO 31000 Mandate & Commitment Design Implementation Monitoring and Review Continual Improvement MAF-Based Governance & Strategic Direction Public Service Values Policy & Programs Citizen-focused Service Accountability Risk Management People Stewardship Results & Performance Learning, Innovation & Change Management Critical points in both ISO 31000 and the MAF-based frameworks are the need to establish Senior-level Oversight, a Risk Management Policy and to invest Resources in people and information systems. Prime Minister s Advisory Committee on the Public Service (February 2009) Senior leaders and elected officials should be prepared to take informed risks to expedite decision making and action on identified priorities in order to deliver results to Canadians Senior-level Oversight is treated as critical by both frameworks because growing in maturity in any new management practice generally requires a culture change. Such a change must occur across all levels of the organization. Senior-level Oversight allows senior management to be better in touch with the plans and strategies established in order to advance risk management and to be aware of the results. From time to time, risk management as a priority will have to be balanced and re-balanced with other priorities. Senior management is uniquely positioned to direct the development of risk management based on being aware of the progress through periodic oversight. Knowing there will be Senior-level Oversight ensures everyone in the organization understands the importance of risk management. It is important to understand that consistent and effective risk management is a key public service value. During interviews, most staff members believed LAC to be averse to risk while others pointed to examples where LAC is willing to tolerate higher levels of risk such as in establishing partnership arrangements and delegating procurement responsibilities. In the February 2009 Public Service Report of the Prime Minister s Advisory Committee, a key recommendation was the need to embrace the taking of informed risks. Providing strategic direction to steer toward a more consistent cultural position on risk is a complex area that requires leadership. Currently, LAC does not have a Risk Management Policy which 15

can be an excellent vehicle for explicitly expressing commitment to managing risk well, including intelligent (information-based) risk taking, as a key public service value of LAC. Everyone in the organization also needs to understand their own roles and responsibilities in risk management, as well as the roles and responsibilities of those who will provide support and oversight. Clarifying the vision for risk management in the organization and associated roles and responsibilities is very effectively done in a Risk Management Policy. The resources issue has been addressed over the past several years by the allocation of a part-time employee (equivalent to 50% FTE) to support the planning group. This level of resource has been able to help LAC develop its Initial Corporate Risk Profile (2007), assist some operational groups adopt more formal risk management practices and develop a draft Risk Management Guide. While this level of investment has enabled LAC to advance to the risk aware level, it is unlikely to be able to take the organization further. Additional resources will be needed to make further meaningful advancement. Additional resources for supporting the organization in its overall risk management arrangements are not the only key investment to consider. LAC s progress on risk management has been limited by the lack of leadership in establishing risk management arrangements. Accordingly, LAC should consider investing in a Corporate Risk Officer (CRO) position. For LAC, this would only require a small investment of resources, but this position would be a strategic enabler in strengthening risk management arrangements and supporting the information needs of the management body responsible for senior management oversight responsibilities. Large organizations like Canada Revenue Agency use the CRO as a key implementation strategy to advance risk management maturity. Their large size is only part of the reason for the CRO strategy, the other reason is the significant challenge of developing common understanding across all branches and levels of the organization this is a challenge for organizations of all sizes. Smaller organizations such as Passport Canada have invested in the CRO strategy recognizing the complexity of the common understanding challenge and the need for leadership. 16

Conclusion Through conscious efforts LAC has become a risk aware organization, as demonstrated in its formalizing risk management practices in key operational areas, integrating risk into planning, and by investing in capacity development through training and guidance documents. However, it will likely be difficult for LAC to grow further in risk management maturity as it does not yet have an adequate set of risk management design and governance arrangements including a vision, framework and an implementation strategy to guide further investment toward risk management maturity. Key elements to more advanced maturity levels are yet missing, including assigned leadership, an oversight arrangement, sufficient support resources, and a policy clearly establishing the department s commitment to risk management (a key public service value) and setting out key principles, roles, responsibilities, processes and common terminology. Without strengthening design and governance arrangements for management of risk, LAC will likely not be able to access key tangible risk management benefits such as ensuring the allocation of resources is proportionate to the level of risk and stakeholder perceptions and misperceptions about risks being effectively understood. These types of benefits are particularly relevant to organizations needing to effectively balance and re-balance growing delivery requirements and expectations with ongoing resource restraint. 17

Recommendation 1. LAC should develop and implement an overall strategy to strengthen risk management, specifically addressing design and governance arrangements by: a. Establishing a governance body to provide oversight of the development of risk management maturity based on a Risk Management Vision and MAF-based Framework; b. Establishing the position of Chief Risk Officer(CRO) to lead and coordinate the management of risk; c. Allocating additional human resources to support the CRO and the overall strategy to strengthen risk management; d. Arranging for training of senior management to ensure common understanding of risk management concepts from the top; and e. Establishing a Risk Management Policy codifying the department s commitment to risk management (as a key public service value) and setting out key principles, roles, responsibilities, processes and common terminology. 18

Criteria: Risk Management Citizen-Focused Service Stewardship People Learning, Innovation & Change Management 2.2 Operational and Support Practices LAC has been active in strengthening its operational and support practices for risk management. All operational and departmental groups had some examples of developing formal approaches and procedures for risk management of exposure areas. In addition, there has been some training and progress toward drafting guidance documents. However, these initiatives are not part of a coordinated overall strategy to identify priority exposure areas, develop and maintain appropriate capabilities including attention to stakeholder risk communication needs, and to provide appropriate tools and guidance. Timely and effective communications about risk based on a developed common understanding, and intelligent (information-based) risk taking are two key future benefits of advanced risk management maturity that can accrue from further strengthening operational and support practices. In Section 2.1 the observation was made that LAC has reached the risk aware level of maturity in part because of a greater use of formal risk management practices. Figure 4 below illustrates examples of formal risk management practices from across the department. A review of these practices revealed a range in the level of detailed risk analysis performed. While some incorporated a fairly general analysis (e.g., items 4 and 7 in Figure 4) and others a more detailed analysis (e.g., items 1 and 8), all were considered to reflect an appropriate level of analysis for the decision needs. 19

Figure 4: Formal Risk Management Practices Organization Strategic Level Documentary Heritage Government Records Corporate Operations Formal Risk Management Practices Formal Risk Management Practice 1. Initial Corporate Risk Profile 2. Innovation Fund Selection Analysis 3. Risk Management Framework to support LAC Loans/Exhibitions Policy and Procedures 4. Audiovisual Mitigation Strategy 5. Risk-based Approach for the Disposition of Legacy Records 6. LAC Project Charter & Business Case Templates 7. The Governance Network (TGN) Preliminary Assessment of Risks 8. Amican Project Risk Management Plan 9. Risk Management Framework for Assessing ATIP Records Most of the formal practices examined, incorporated a technique known as expert estimation based on criteria established for levels of Impact and Likelihood. The expert estimation technique fits very well in public sector decision making where data for more quantitative analysis are generally not available. Also, in the public sector, new initiatives are a regular part of evolving stakeholder expectations. The risks of these initiatives must be estimated given little prior data on which to conduct quantitative analysis. Particular mention must be made that some of the formal tools incorporate fairly advanced techniques (in comparison to other departments and agencies) such as customized assessment criteria (item #3, Figure 4) and inclusion of stakeholder analysis (items # 1, 3, and 9, Figure 4). There was also one example observed of the technique known as risk factoring. The risk factoring technique was used to assess the level of risk associated with projects proposed for the Innovation Fund using three (3) weighted risk factors as shown below in Figure 5. 20

Figure 5: Example of Risk Factoring Technique This is an excellent method whenever there exists a finite universe of units to which a quick risk assessment is needed for each unit. The risk factoring technique generally has a wide scope of use as most parts of an organization have some sort of universe on which they could apply risk factoring to quickly establish a risk level for each unit. The above examples represent an excellent start but there was no approach being used to understand which examples are the most critical risk exposure areas of the department where an effective balance of formal and informal risk management practices would be very important. These areas can be referred to as Priority Risk Areas (PRAs). The PRA approach would ensure that further investments in strengthening operational risk management is better calculated and addressed systematically. A key criterion for attaining the risk aware level of maturity is the integration of risk into annual business planning. LAC started this integration last year and augmented it this year. The template used by all parts of the organization for planning 2009 2010 is set out in Figure 6 below. 21

Figure 6: Risk Integrated into the Planning Template Integrating risk and planning is a very natural concept because both risks and planning are future orientated. Risks are events and circumstances that may occur in the future. Risks are also characterized by uncertainty in other words, they may occur fully as expected or they may occur to a lesser or a greater degree. Risks are critical to consider when setting plans in order to be proactive on those considered high so that plans can succeed. Plans must address problems as well as risks the difference being that problems describe existing issues to which the impact is fully known (if counter measures are not taken). There is no uncertainty with problems as there is with risks. In completing planning templates, many people mistakenly describe problems instead of risks. They describe a current issue, whereas the risk information being requested relates to future events that may happen over the planning horizon so that strategies can be devised to mitigate the risks and thereby avoid disruption of plans. A review of the 2009 2010 completed planning templates indicated the expected range of some templates were done well, and some were needing improvement. Inclusion of problems instead of risks was a typical deficiency and items were not described in terms of its future orientation and uncertainty ( will likely happen instead of will happen). The opportunity to practice identifying and describing risks through the planning process is excellent given that stewardship requirements of risk management are expanding. The TBS Policy on Transfer Payments (October 2008) has specific risk management requirements as does the Policy on Financial Management Governance (April 2009). Through MAF assessments and other sources such as the Prime Minister s Advisory Committee on the 22

Public Service, LAC is aware that strengthening risk management is a priority and an area where more specific accountabilities should be expected in all future policies from TBS. Many of the staff members interviewed during the audit expressed that they had little, if any, risk management training and they recognized this as an important gap relative to the new formal processes they have noticed coming into force. Some risk management training was provided to planning network staff in 2005 and in 2008 there was an orientation session on risk management for selected managers. In addition, a risk management presentation was planned for the Management Forum in May 2009. Overall, the extent of risk management training has been quite limited and reflects the confusion between problems and risks in completing annual business plans. Another point related to the planning process is reporting. As reporting against plans is further refined at LAC, there should be consideration as to how information on the progress of risk management can be reported. Reporting of progress on performance and risk should be integrated. As risk assessment continues to become increasingly important to good management and policy compliance, it will be critical to establish a solid common understanding of risks and risk management. This can be addressed in part by training and hands-on practice but also by guidance documents, tools and information systems. During the audit it was noted that a Risk Management Guide had been drafted but had not been fully reviewed, translated, published and disseminated across the department. This guide is an important initiative in establishing common understanding. The guide was initiated before ISO 31000 was available. Accordingly, the document can be strengthened by another update to align it with ISO 31000. In addition, making the guide available electronically, via a risk management portal, would be effective for quick reference. Conclusion LAC has been active in strengthening its operational and support practices for risk management across all criteria areas examined. Formal approaches and procedures are being developed to complement informal risk management, inclusion of stakeholder interests in formal methods is being recognized, there is awareness of risk stewardship requirements reflected in TBS policies, and there has been some training and progress toward drafting guidance documents. 23

However, these initiatives are not part of a coordinated overall strategy to develop and maintain appropriate capabilities, methods, tools and guidance. Without further efforts to continue strengthening operational and support practices, key benefits such as timely and effective communications about risk and intelligent (information-based) risk taking may not accrue to LAC. Recommendations 2. LAC should ensure that the strengthening of risk management operational and support practices are included in the overall strategy, including: a) Establishing a listing of Priority Risk Areas identifying high exposure areas of the department as a means of focusing attention on the most critical areas that need an effective balance of formal and informal practices for risk management; b) Establishing and implementing a knowledge transfer plan incorporating training courses customized for LAC covering orientation to more advance skills for those who will provide leadership and support roles; c) Ensuring the Risk Management Guide is updated in line with ISO 31000, translated and issued across the department (including electronic posting via a risk management portal); d) Establishing an approach for monitoring and reporting on progress in managing risk integrated with overall performance monitoring and reporting at LAC. 24

APPENDIX A AUDIT CRITERIA Risk Management Area 1. Governance & Strategic Direction Criteria There is senior management direction on the vision for integrated risk management (principles, framework, and processes) that is tailored and responsive to the organization s external and internal context, and that supports government-wide management of risk Risk is managed horizontally (across all programs), vertically (across all levels of the organization), and functionally ensuring appropriate integration into all key planning, policy-making, delivery, and decision-making processes. There is ongoing Senior-level Oversight of: the management of risks at all levels, effectiveness of risk management arrangements, and adherence to risk management policy Guidance is provided on risk tolerance and risk mitigation strategies 2. Public Service Values Departmental culture recognizes the presence of risk in all activities and the need to explicitly manage risk through mitigation, avoidance, transfer, or sharing Departmental culture values good risk management as a key component of managerial excellence Risk Management Policy defining principles, roles, responsibilities, processes, and terms is a key part of the department s risk management arrangements 3. Policy & Programs Annual risk management planning (including environmental scanning) is conducted to refine key risks, their management approaches, and to refine the department s risk management arrangements covering Risk Universe, risk tolerance, stakeholders, competencies, etc. 4. Results & Performance Relevant information on risk is gathered and used to make decisions Performance of the risk management arrangements toward Risk Maturity is reported annually to senior management Reporting and disclosure to senior management, central agencies, Parliament, and the public is balanced, transparent and easy to understand. 25

Risk Management Area Criteria 5. Accountability Risk management roles and responsibilities are integrated into the departmental accountability mechanisms (job descriptions, performance reviews, Terms of Reference, etc.) An effective balance established between informal (intuitive) and formal (systematic, structured) risk management is established and maintained based on context, urgency and significance of risk exposure (within the Risk Universe) 6. Risk Management 7. Citizen-focused Service 8. Stewardship Risk is not mitigated to absolute minimum as a general rule which can stifle creativity and innovation. Rather, it is reduced to a tolerable or acceptable level. External risk communications and stakeholder engagement is carried out on an ongoing basis to ensure needs, issues and concerns, risk perceptions and misperceptions (Government of Canada or stakeholders) are included in risk analysis and decision making Risk-related requirements of relevant control-related authorities are incorporated: Financial Administration Act, Federal Accountability Act, TBS policies Indicators for results, risk and accountability managed in an integrated manner 9. People Risk management competency and resource needs are determined and developed covering risk assessment, risk management, and risk communications Information on risk is communicated in a timely manner 10. Learning, Innovation & Change Management Ongoing risk management learning is developed and implemented Change management principles and practices are applied, including planning for appropriate resources (i.e., people, systems, finances, etc.) 26

APPENDIX B MAF-BASED INTEGRATED RISK MANAGEMENT FRAMEWORK Governance & Strategic Directions There is senior management direction on the vision for integrated risk management (principles, framework, and processes) that is tailored and responsive to the organization s external and internal context, and that supports governmentwide management of risk Risk is managed horizontally (across all programs), vertically (across all levels of the organization), and functionally ensuring appropriate integration into all key planning, policy-making, delivery, and decision-making processes. There is ongoing Senior-level Oversight of: the management of risks at all levels, effectiveness of risk management arrangements, and adherence to risk management policy Public Service Values Departmental culture recognizes the presence of risk in all activities and the need to explicitly manage risk through mitigation, avoidance, transfer, or sharing Departmental culture values good risk management as a key component of managerial excellence Policy & Programs Risk Management Policy defining principles, roles, responsibilities, processes, and terms is a key part of the department s risk management arrangements Annual risk management planning (including environmental scanning) is conducted to refine key risks, their management approaches, and to refine the department s risk management arrangements covering Risk Universe, risk tolerance, stakeholders, competencies, etc. Risk Management An effective balance established between informal (intuitive) and formal (systematic, structured) risk management is established and maintained based on context, urgency and significance of risk exposure (within the Risk Universe) Risk is not mitigated to absolute minimum as a general rule which can stifle creativity and innovation. Rather, it is reduced to a tolerable or acceptable level. People Risk management competency and resource needs are determined and developed covering risk assessment, risk management, and risk communications Information on risk is communicated in a timely manner Stewardship Risk-related requirements of relevant control-related authorities are incorporated: Financial Administration Act, Federal Accountability Act, TBS policies Indicators for results, risk and accountability managed in an integrated manner Learning, Innovation and Change Management Citizen-focused Service External risk communications and stakeholder engagement is carried out on an ongoing basis to ensure needs, issues and concerns, risk perceptions and misperceptions (Government of Canada or stakeholders) are included in risk analysis and decision making Accountability Risk management roles and responsibilities are integrated into the departmental accountability mechanisms (job descriptions, performance reviews, Terms of Reference, etc.) Results & Performance Relevant information on risk is gathered and used to make decisions Performance of the risk management arrangements toward Risk Maturity is reported annually to senior management Reporting and disclosure to senior management, central agencies, Parliament, and the public is balanced, transparent and easy to understand. Guidance is provided on risk tolerance and risk mitigation strategies Ongoing risk management learning is developed and implemented Change management principles and practices are applied, including planning for appropriate resources (i.e., people, systems, finances, etc.) 27